CVE-2026-58369

Name of the Vulnerable Software and Affected Versions Woodpecker versions prior to 3.15.0

Description The software registers the '/api/orgs/lookup/*org full name' endpoint without authentication middleware. The LookupOrg handler unconditionally dereferences the session user (user.ForgeID via ForgeFromUser) when selecting the forge to query. For unauthenticated requests, the session user returns nil, triggering a NULL pointer dereference. While the server continues to operate by returning an HTTP 500 error, each request generates a multi-line panic stack trace in the error log. An unauthenticated attacker can repeatedly probe this endpoint to flood the logs, increasing disk usage and log-ingestion costs while obscuring legitimate log events.

Recommendations Update to version 3.15.0 or later.